Trying to get into boot on PTZ

Revo2Maxx

Revo2Maxx

IPCT+ Member
Jan 1, 2024
760
351
USA
So before I make the next part of trying to repair this camera and that requires me to pull chips and I am not there yet. I want to make sure that I have exhausted all other ideas.. So some time ago I had to make a script for gaining access to the Uboot when it was locked. I have tried that here as well and didn't work. Code is below if you happen to be trying to get access to Uboot maybe running this script can help in case when you have no way to stop Uboot from running.. Now this didn't work in my case but thought I would ask if someone has something that worked for them while trying to get access to the Uboot.. The camera will not respond to anything because the camera was Firmware Blocked from using wrong FW.. With it connected, Nmap has nothing when probing, So wireshark does show that it is asking for ARP data for 192.168.1.1 from the default 192.168.1.108 IP, I can't connect to that IP but if I do Ping it I do get a reply so the camera isn't 100% dead.

So what I know, The SoC that supports the IR, PTZ motors, fans and all that good stuff is still active and not damaged so far. I get this because with the other cameras I have repaired the camera does the PT dance like it is alive this camera also has a Wiper and it also is active. I know these are not 100% controlled by the camera module because if you remove the module like I have and power the camera it will do the dance and run IR testing and then after they have run the Wiper runs just like it would when camera is in working order.. I really wish that these cameras would be programmed to test camera module before running all other functions as a way to know for sure there is damage to the camera lol.. I mean there are so many people out there with dead cameras that think they are good because there is PTZ dance, and ACT on the switch that makes it look like the camera is working. Anyway.. This camera has to many SoC's lol.. One I am in need of repairing is the one in the Camera module. It is wrong firmware broke.. Uboot does check and passes, then it fails to keep going because of the bad FW.. I now have the right FW for the camera..

Sending me to another part of the Forum to show how to recover a dead camera isn't what I am looking for, Also know that part, I am looking for someone that had same issue and was able to gain access to Uboot when it was locked out?

Thank you

Interesting it won't let me post with my code? If this posted it was because I removed the code HUH?
 

Attachments

  • Screenshot (279).png
    Screenshot (279).png
    28.8 KB · Views: 0
Lets try code here lol..

Python: 
import serial
import time

# Replace with your COM port
SERIAL_PORT = 'COM3'
BAUDRATE = 115200  # Confirm matches what you see on UART

# List of poke sequences
poke_sequences = [
    b'\r',             # Enter
    b' ',              # Space
    b'\x03',           # Ctrl+C (ETX)
    b'\x1B',           # ESC
    b'@',              # Known bootloader escape
    b'u',              # Some systems listen for 'u' for upload
]

def try_poke():
    with serial.Serial(SERIAL_PORT, BAUDRATE, timeout=0.5) as ser:
        print(f"Poking {SERIAL_PORT} at {BAUDRATE} baud...")

        for seq in poke_sequences:
            ser.write(seq)
            print(f"Sent: {repr(seq)}")
            time.sleep(0.2)
            output = ser.read(512)
            if output:
                print("Response:")
                print(output.decode(errors="ignore"))
            else:
                print("No response.\n")

        # Keep alive to interact manually after script
        print("Switching to manual mode. Press Ctrl+C to exit.")
        while True:
            data = ser.read(512)
            if data:
                print(data.decode(errors="ignore"), end='', flush=True)

if __name__ == '__main__':
    try_poke()
 
Not to many people repair their cameras around here. You should try another forum, maybe badcaps. or similar.
 
You must log in or register to reply here.
Top Bottom